Skill Description Deception Attack against Task Routing in Internet of Agents
2026-05-11 • Multiagent Systems
Multiagent Systems
AI summaryⓘ
The authors introduce the Internet of Agents (IoA), a system where different AI agents work together by sharing what skills they have. They found a new type of attack where bad agents lie about their skills to trick the system into giving them more tasks. This attack, called Skill Description Deception (SDD), can cause serious problems by disrupting tasks and making the system less reliable. The authors created a way to automatically test how vulnerable IoA systems are to this attack and showed it can be very effective. They highlight the need for better security methods to prevent such deception in future IoA networks.
Internet of Agents (IoA)Large Language Models (LLM)skill descriptiontask routingSkill Description Deception (SDD)agent collaborationsecurity vulnerabilitysemantic routingattack frameworksystem reliability
Authors
Jiayi He, Xiaofeng Luo, Jiawen Kang, Ruichen Zhang, Jianhang Tang, Dong In Kim
Abstract
A new paradigm, Internet of Agents (IoA), is transforming networked systems into LLM-driven service networks, where heterogeneous agents collaborate through task routing based on their self-declared skill descriptions. Although this promising paradigm enables agentic, distributed, and advanced intelligence, it also exposes a new and overlooked attack surface. In particular, malicious agents can strategically manipulate their skill descriptions to bias routing decisions and increase their probability of being selected for task execution, thereby disrupting user tasks and degrading system reliability. To characterize this threat, we propose and formalize a new attack model, termed \emph{Skill Description Deception} (SDD) attack. We further design an LLM-enabled SDD attack framework that automatically generates deceptive skill descriptions, enabling systematic vulnerability assessment of IoA systems. Experimental results on nine representative domains show that the proposed attack can achieve up to 98\% attack success rate, demonstrating the severity and generality of the attack. Our paper reveals a new security vulnerability in IoA and calls for secure and trustworthy semantic routing mechanisms for future IoA systems.